By Alia Noor, FCMA, CGMA, MBA
UAE Registered Tax Agent | Associate Partner – Taxation & Compliance Advisory
Ahmad Alagbari Chartered Accountants
Sun Tzu was a military strategist whose The Art of War has influenced thinking on strategy, leadership and competition for more than two thousand years.
His battlefield was military. Ours is not.
Yet the principles he wrote about—knowing the terrain, understanding the adversary, recognizing deception, preparing before acting and choosing battles carefully—have an unexpected relevance for auditors navigating the age of artificial intelligence.
AI has changed the audit battlefield. It can analyse vast populations of transactions, generate information, recommend decisions and increasingly act through autonomous systems. At the same time, it can create convincing documents, synthetic identities and manipulated evidence that are increasingly difficult to distinguish from the real thing.
For auditors, the challenge is therefore no longer simply how to use AI. It is how to provide assurance when AI itself becomes part of the decision, the control and even the evidence.
And that is where Sun Tzu becomes relevant again.
Know Thy Enemy: But Can You See It?
“If you know the enemy and know yourself, you need not fear the result of a hundred battles.” — Sun Tzu
Knowing the battlefield sounds straightforward. In the age of AI, it may be anything but.
An organization can have an AI policy, approved applications and a governance framework, while the reality inside the business looks quite different. Employees may use public AI platforms, business functions may acquire their own tools, and AI capabilities may appear inside existing enterprise software almost unnoticed.
Welcome to Shadow AI.
For auditors, this creates an interesting problem. The traditional starting point is often the documented control environment. But what if the map no longer matches the territory?
The AI policy tells us where AI should be. The auditor needs to discover where it actually is.
Once we find it, another question emerges: who is responsible for what it does?
Suppose an AI model influences a credit decision, estimates an accounting provision or identifies a transaction as suspicious. The decision is wrong. Management points to the model. Technology points to the vendor. The vendor points to the data.
Accountability cannot be allowed to travel in circles.
The machine may make the recommendation. Accountability must still have a human address.
Sun Tzu’s lesson remains timeless: understand the real battlefield before attempting to provide assurance over it.
All Warfare Is Based on Deception: When Evidence Becomes the Enemy
“All warfare is based on deception.” — Sun Tzu
Imagine opening an audit file.
The invoice is there. So is the contract. The email approval appears to come from the CFO. There is supporting correspondence and perhaps even a voice message confirming the transaction.
Everything fits.
Except the supplier does not exist.
The invoice was generated. The contract was fabricated. The correspondence was imitated. The voice belonged to an algorithm.
Suddenly, Sun Tzu’s ancient warning sounds remarkably modern.
Fraud has always depended on making something false appear credible. AI has not invented deception; it has made the disguise considerably more convincing.
And that creates a fascinating problem for assurance.
Auditors have traditionally worried about whether they have enough evidence. AI may introduce the opposite problem.
The next audit evidence crisis may not be insufficient evidence. It may be perfectly convincing evidence that was never real.
Professional scepticism must therefore extend beyond what evidence tells us to the authenticity of the evidence itself. Where did it originate? Can the source be authenticated? Has it been altered? Does an independent trail support it?
In the age of AI, evidence may increasingly need to establish something once more readily assumed:
that it actually existed.
Victorious Warriors Win First: Govern Before You Depend
“Victorious warriors win first and then go to war, while defeated warriors go to war first and then seek to win.” — Sun Tzu
Sun Tzu understood that preparation could determine the outcome before the battle began.
The same principle applies to AI governance. Organizations need to understand which AI systems influence significant decisions, what data they use, what authority they possess, how their outputs are validated and where human intervention remains essential. Discovering these answers only after something goes wrong is governance by hindsight.
For auditors, there is another important lesson: AI cannot remain imprisoned inside an “IT risk” box.
If AI influences an impairment assessment, it has entered financial reporting. If it prioritizes AML alerts, it has entered compliance. If an AI agent executes activities within an enterprise system, it has entered internal control.
AI risk follows the decision, not the department.
The real exposure lies not in how many AI applications an organization has, but in how much consequential activity has come to depend upon them.
Adapt to the Terrain: Turn the Weapon Around
“Just as water retains no constant shape, so in warfare there are no constant conditions.” — Sun Tzu
AI is not only something auditors must provide assurance over. Auditors can use it too.
It can examine entire transaction populations, uncover unusual relationships across datasets, analyse large volumes of contractual information and surface anomalies at a speed traditional methods could never match.
That is an extraordinary opportunity. It is also where overconfidence can enter.
A sophisticated output can look authoritative. An AI-generated analysis can be polished, detailed and produced in seconds.
But polished is not the same as correct.
Auditors can use AI to challenge management, but they must remain willing to challenge the AI they use.
Technology may change how quickly an auditor reaches an issue and how deeply it can be investigated. What it cannot do is assume responsibility for the conclusion.
AI can extend the auditor’s reach. It cannot inherit the auditor’s judgement.
Know When to Fight: Follow the Consequence
“He will win who knows when to fight and when not to fight.” — Sun Tzu
As AI spreads, auditors could easily begin chasing every algorithm simply because it is new.
That would be poor strategy.
Not every AI application creates the same exposure. What matters is not merely whether AI is present, but what depends upon it. An AI system influencing financial reporting, regulatory submissions, fraud monitoring, credit decisions or critical controls deserves attention because its failure could have significant consequences.
The audit plan should therefore follow consequence, not novelty.
This is where an ancient strategy meets a familiar audit principle. Sun Tzu concentrated resources where they could influence the outcome; risk-based assurance directs attention where failure could influence the organization.
The technology is new. The strategy is ancient.
The Art of Audit War
Sun Tzu’s battlefield was fought with armies. The auditor’s battlefield is fought with information, evidence, systems, controls and increasingly intelligent machines.
Yet the strategic disciplines remain remarkably familiar: understand the terrain, recognize deception, prepare before dependence develops, adapt as conditions change and concentrate attention where failure matters most.
AI will undoubtedly change how audits are performed. But as machines become better at generating information, making recommendations and producing apparently convincing answers, the qualities that distinguish a good auditor become more—not less—important.
Judgement. Curiosity. Independence. Professional scepticism.
More than two thousand years ago, Sun Tzu understood the danger of entering a battlefield without understanding it. Today’s auditor faces a modern version of the same challenge: a battlefield where information can be abundant, sophisticated and entirely convincing without necessarily being true.
Technology will continue to change the weapons.
It should never change the instinct to question what appears certain.
Because in the Art of Audit War, the greatest advantage may still belong to the auditor who knows when not to believe what everyone else already has.
Disclaimer
This article is intended for general information and thought leadership purposes only. It does not constitute audit, accounting, legal, tax or other professional advice. The views expressed are those of the author. References to Sun Tzu’s The Art of War are used to explore strategic principles in the context of modern auditing and artificial intelligence.
Leave a Reply